[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Is there a known rpc.statd buffer overflow?

Hi list,

I received the following (see below) in an email from logcheck on my
home desktop running Sarge.  Looks like an attempt to cause a buffer
overflow in rpc.statd.  System logs don't include anything else that
looks suspicious.

This system was up-to-date with security updates as of yesterday.  I had
the portmap, nfs-common, and nfs-kernel-server packages installed in
order to share files from my desktop to my laptop.  I thought I had the
system configured to deny access except to the local net (192.168/16),
but unfortunately that wasn't the case due to an error in my
/etc/hosts.deny (now fixed).

I think I'm OK since a statically compiled (on another Sarge machine)
chkrootkit doesn't turn up anything, and the md5sums of important system
binaries and libraries match my other Sarge workstation.  But is there a
known buffer overflow in statd that a DSA should be issued for?

-------- Original Message --------
Subject: wisteria 2005-11-09 01:02 System Events
Date: Wed, 09 Nov 2005 01:02:05 -0500
From: logcheck@Princeton.EDU
To: root@kmccarty.student.Princeton.EDU

This email is sent by logcheck. If you wish to no-longer receive it,
you can either deinstall the logcheck package or modify its
configuration file (/etc/logcheck/logcheck.conf).

System Events
Nov  9 00:36:33 wisteria rpc.statd[1450]: gethostbyname error for

Kevin B. McCarty <kmccarty@princeton.edu>   Physics Department
WWW: http://www.princeton.edu/~kmccarty/    Princeton University
GPG: public key ID 4F83C751                 Princeton, NJ 08544

Reply to: